GHSA-M8R3-22V6-G877
Vulnerability from github – Published: 2026-09-23 14:09 – Updated: 2026-09-23 14:09Summary
The rex_api_install_package_update API function (install addon) does not override requiresCsrfProtection(), which defaults to false in the base class rex_api_function. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO package server.
Details
File: redaxo/src/core/lib/api_function.php:277-280
protected function requiresCsrfProtection()
{
return false; // DEFAULT — subclasses must opt in
}
File: redaxo/src/addons/install/lib/api/api_package_update.php:8-39
class rex_api_install_package_update extends rex_api_function
{
public function execute()
{
if (!rex::getUser()?->isAdmin()) {
throw new rex_api_exception('You do not have the permission!');
}
$addonkey = rex_request('addonkey', 'string');
$fileId = rex_request('file', 'int');
$installer = new rex_install_package_update();
// ... downloads and installs $addonkey version $fileId from redaxo.org
}
// requiresCsrfProtection() NOT overridden — defaults to false
}
For comparison, rex_api_install_package_add and rex_api_install_package_delete both correctly return true. Only rex_api_install_package_update is missing this.
PoC
<!-- Attacker-controlled page -->
<img src="https://victim-redaxo.example.com/index.php?page=install/packages&rex-api-call=install_package_update&addonkey=some_addon&file=42" />
When an authenticated admin visits this page, the request is automatically made with their session cookie, causing some_addon to be updated to version file_id=42.
Impact
An attacker who can lure an admin to a malicious page can force-install specific addon versions. If combined with a supply-chain compromise of a package on redaxo.org, or by targeting a downgrade to a known-vulnerable version, this becomes a remote code execution vector. Even without supply-chain compromise, it can be used to disrupt the site by forcing unwanted updates.
Fix
Add requiresCsrfProtection() to rex_api_install_package_update:
protected function requiresCsrfProtection()
{
return true;
}
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.21.1"
},
"package": {
"ecosystem": "Packagist",
"name": "redaxo/source"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.21.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-63000"
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-23T14:09:15Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nThe `rex_api_install_package_update` API function (`install` addon) does not override `requiresCsrfProtection()`, which defaults to `false` in the base class `rex_api_function`. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO package server.\n\n### Details\n**File:** `redaxo/src/core/lib/api_function.php:277-280`\n```php\nprotected function requiresCsrfProtection()\n{\n return false; // DEFAULT \u2014 subclasses must opt in\n}\n```\n\n**File:** `redaxo/src/addons/install/lib/api/api_package_update.php:8-39`\n```php\nclass rex_api_install_package_update extends rex_api_function\n{\n public function execute()\n {\n if (!rex::getUser()?-\u003eisAdmin()) {\n throw new rex_api_exception(\u0027You do not have the permission!\u0027);\n }\n $addonkey = rex_request(\u0027addonkey\u0027, \u0027string\u0027);\n $fileId = rex_request(\u0027file\u0027, \u0027int\u0027);\n $installer = new rex_install_package_update();\n // ... downloads and installs $addonkey version $fileId from redaxo.org\n }\n // requiresCsrfProtection() NOT overridden \u2014 defaults to false\n}\n```\n\nFor comparison, `rex_api_install_package_add` and `rex_api_install_package_delete` both correctly return `true`. Only `rex_api_install_package_update` is missing this.\n\n### PoC\n```html\n\u003c!-- Attacker-controlled page --\u003e\n\u003cimg src=\"https://victim-redaxo.example.com/index.php?page=install/packages\u0026rex-api-call=install_package_update\u0026addonkey=some_addon\u0026file=42\" /\u003e\n```\nWhen an authenticated admin visits this page, the request is automatically made with their session cookie, causing `some_addon` to be updated to version `file_id=42`.\n\n### Impact\nAn attacker who can lure an admin to a malicious page can force-install specific addon versions. If combined with a supply-chain compromise of a package on redaxo.org, or by targeting a downgrade to a known-vulnerable version, this becomes a remote code execution vector. Even without supply-chain compromise, it can be used to disrupt the site by forcing unwanted updates.\n\n### Fix\nAdd `requiresCsrfProtection()` to `rex_api_install_package_update`:\n```php\nprotected function requiresCsrfProtection()\n{\n return true;\n}\n```",
"id": "GHSA-m8r3-22v6-g877",
"modified": "2026-09-23T14:09:15Z",
"published": "2026-09-23T14:09:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877"
},
{
"type": "WEB",
"url": "https://github.com/redaxo/core/pull/6579"
},
{
"type": "WEB",
"url": "https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3"
},
{
"type": "PACKAGE",
"url": "https://github.com/redaxo/core"
},
{
"type": "WEB",
"url": "https://github.com/redaxo/core/releases/tag/5.21.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates"
}
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.